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I.  INTRODUCTION  AND  PRELIMINARIES 


When  a  signal  detector  designed  on  some  theoretical  basis  is  actu¬ 
ally  pnt  to  use,  its  performance  is  often  not  as  good  as  the  theory 
predicted.  The  tiro  principal  causes  of  this  phenomenon  are  inaccuracies 
in  the  underlying  statistical  model,  and  inaccuracies  due  to  the  comput¬ 
ing  device  which  processes  the  observations.  Methods  to  deal  with  the 
former  problem  come  under  the  heading  of  robust  detection.  The  latter 
problem  really  has  two  parts,  one  due  to  the  inherent  finite  precision 
of  the  computer,  which  necessitates  the  use  of  a  numerically  stable 
algorithm,  and  one  due  to  actual  hardware  faults  in  the  computing  dev¬ 
ice.  In  this  paper  we  will  determine  the  effects  of  hardware  faults  on 
detector  performance,  and  we  will  propose  and  analyze  some  methods  for 
masking  these  effects.  The  result  will  be  a  fault-tolerant  detector:  one 
which  will  satisfy  desired  performance  criteria  even  when  implemented  on 
an  imperfect  computing  device. 

In  this  paper  we  will  be  concerned  with  the  non- sequential  binary 
detection  problem  in  which  the  hypotheses  are  "signal  present"  and  "sig¬ 
nal  absent".  Whatever  decision  criterion  is  adopted,  the  relevant 
hypothesis  test  results  in  a  decision  variable  d*.  If  d*  =  1  the  signal 
is  declared  present,  and  if  d*  *  0  the  signal  is  declared  absent.  Let  S 
be  the  event  that  the  signal  is  present,  let  Sc  be  the  event  that  the 
signal  is  absent,  and  suppose  P(S)  is  unknown.  We  will  measure  the  per¬ 
formance  of  the  theoretical  detector  by  the  probability  of  false  alarm 
Pp  and  the  probability  of  detection  P*,  where 


P*  =  P(d  =1  Is®) 

P*  «  P(d*=l|S). 

The  receiver  operating  characteristic  (ROC)  relates  P*  to  P*  The 

U  I* 

ROC  will  be  expressed  in  functional  form  as 

pj  =  f(P*).  (1.1) 

Any  point  (P*,P*)  on  the  ROC  will  be  called  an  operating  point  of  the 
theoretical  detector. 

Suppose  that  performance  bounds  P?  and  P?  are  given  on  the  proba- 

r  D 

bilities  of  false  alarm  and  detection,  respectively.  An  operating  point 
(P*,P*)  will  be  called  feasible  if  P*  <  P°  and  P*  >  pjj.  To  simplify  the 
exposition  of  onr  results  we  shall  restrict  attention  to  the  case  of 
practical  interest  stated  in  the  following  hypothesis. 

Hypothesis  1: 

(i)  Pj)  <  0.5 

(ii)  Pjj  >  0.5 

(iii)  The  theoretical  detector  has  at  least  one  feasible  operating 
point. 


In  Section  II  we  show  how  the  performance  of  the  theoretical  detec¬ 
tor  is  affected  when  it  is  implemented  on  an  imperfect  computing  device. 
Te  characterize  the  minimum  device  reliability  that  is  necessary  to 
guarantee  that  the  implemented  detector  has  at  least  one  feasible 
operating  point.  In  Sections  III  and  IV  we  show  how  to  decrease  this 
minimum  device  reliability  using  either  unconditional  or  conditional 


sacking  s chose s  bated  on  hardware  redundancy.  An  example  it  pretented 
in  Section  V. 

Ve  note  that  the  ate  of  hardware  redundancy  for  reliability  pur- 
potet  it  not  new.  The  idea  goet  b  to  work  done  in  the  Fiftiet  by  von 
Neumann  [8,  pp.  322-378]  and  Moore  and  Shannon  [6].  Thit  early  work  it 
tusmarized  in  [1,  Ch.  7].  Since  then,  many  retearchert  have  continued 
to  inveatigate  thete  technique! ;  tee  for  example  [2],  [3],  [4],  [5]. 

The  work  cited  above  it  concerned  only  with  the  evaluation  of  the 
reliability  of  unconditional  sacking  tchemet,  without  reference  to  any 
tpecific  problem  in  which  the  computing  devicet  night  be  uted.  On  the 
contrary,  our  work  analyze!  the  impact  of  hardware  faultc  and  accociated 
sacking  tchemet  on  the  tpecific  problem  of  tignal  detection. 
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II.  PERFORMANCE  OF  THE  IMPLEMENTED  DETECTOR 

Suppose  that  the  theoretical  detector  described  in  the  previous 
section  is  isiplesiented  on  a  computing  device  which  carries  out  the 
hypothesis  test  and  produces  a  decision  variable  d.  If  d  ■  1  the  signal 
is  declared  present,  and  if  d  ■  0  the  signal  is  declared  absent.  The 
probabilities  of  false  alarm  and  detection  for  the  implemented  detector 
are 


Pp  *  P(d=l |SC) 

PD  =  P(d=llS). 

One  would  like  the  implemented  detector  to  meet  the  same  performance 
constraints  as  the  theoretical  detector;  that  is,  P  ^  p®  and  P_  >  P® 
This  will  obviously  be  the  case  if  the  computed  decision  variable  d  is 
always  equal  to  the  theoretical  decision  variable  d*.  In  general,  how¬ 
ever,  d  and  d*  may  be  unequal  due  to  hardware  failures  in  the  computing 
device.  Ve  will  now  relate  the  performance  of  the  implemented  detector 
to  that  of  the  theoretical  detector  under  the  physically  reasonable 
assumption  that  the  presence  of  the  signal  and  the  value  of  the  theoret¬ 
ical  decision  variable  are  each  independent  of  the  correctness  of  the 
computations.  Therefore  we  shall  adopt  the  following  hypothesis: 

Hypothesis  £:  The  events  S  and  (d*=l)  are  each  independent  of  the  event 


With  this  hypothesis  the  following  theorem  can  be  established 


Theorem  1.:  If  Hypothesis  2  is  satisfied, 

Pp  =  SPp  +  (1-KHl-P*) 

PD  -  «£  +  (1-k)(1"pd) 

where  X  =  P(d=d*) . 

$  c 

Proof :  Let  B  be  the  event  (dBd  )  and  let  B  be  its  complement 

definition  of  P_  implies 
I* 

p  =  PM.l  and  SC)  =  X  +  Y 
F  P(SC)  P(SC) 

where 


X  *  PU»1  and  Sc  and  B) 

Y  =  P(d=l  and  Sc  and  Bc) . 

Since  the  events  (d»l  and  B)  and  (d*=l  and  B)  are  identical, 
events  (d=l  and  Bc)  and  Cd*>0  and  Bc)  are  identical, 

X  =  P(d*-1  and  Sc  and  B) 

Y  =  P(d**=0  and  Sc  and  Bc). 


Then  using  Hypothesis  2, 


C 


C 


.  The 


and  the 


X  =  P(d*=l  and  SC)P(B)  =  P(d*=l |SC)P(SC)P(B) 

P(d*=©  and  SC)P(BC)  =  P(d*«0 |SC)P(SC)P(BC)  =  (1  -  P(d*=l |SC) )P(SC) (1 


and  Eq.  (2.1)  follows.  The  proof  of  Eq.  (2.2)  proceeds  along  the  same 
lines.  O 


The  &0C  of  the  implemented  detector  may  be  obtained  from  the  ROC  of 
the  theoretical  detector  and  the  valne  E  that  characterizes  the  accnracy 
of  the  implementation.  Withont  loss  of  generality  we  can  take  K  2  0.5. 
If  E  ■  0.5  the  ROC  of  the  implemented  detector  is  the  single  point 
(0.5,0. 5).  If  E  >  0.5  then  Eq.  (2.1)  implies  1  -  E  1  P„  (  E  and 

r 


•  _  PF  I  (1~K) 


PF  = 


2E-1 


(2.3) 


Substitution  into  Eq.  (1.1)  and  then  into  Eq.  (2.2)  yields 


PD  =  ( 2E-1 ) f 


-  (1-E) 
2K-1 


+  1-E  =  fK(Pp),  1-E  1  Pp  £  E,  E  >  0.5  .(2.4) 


Note  that  the  functional  form  for  the  implemented  ROC  satisfies  f^(.)  = 
f(.),  fK(l-E)  *  1-E  and  fg(E)  =  E. 

Any  point  (P^.P^)  on  the  implemented  ROC  will  be  called  an  operat¬ 
ing  point  of  the  implemented  detector.  As  before,  an  operating  point 
(Pp,Pp)  is  feasible  if  Pp  £  F:!  and  Pp  2  An  examination  of  Eqs. 

(2.1)  -  (2.2)  shows  that  as  E  decreases  from  1,  the  operating  point 
(Pp,Po)  of  the  implemented  detector  moves  on  a  straight  line  from 
(Pp.Pp)  toward  (1-Pp,l-P*).  This  fact  immediately  gives  the  following 
corollary. 

Corollary  i,:  Under  Hypotheses  1  and  2,  given  a  feasible  theoretical 
operating  point  (P*,P*),  the  corresponding  operating  point  of  the  imple¬ 
mented  detector  is  also  feasible  if  and  only  if 
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Note  that  Eq.  (2.4)  implies 

£.ia  i  1  - 

Equations  (2.1)  and  (2.2)  express  the  performance  of  the  imple¬ 
mented  detector  as  a  function  of  the  performance  of  the  theoretical 
detector  and  K,  the  probability  of  coincidence  between  the  implemented 
and  theoretical  decision  variables.  The  next  step  is  to  express  K  in 
terms  of  hardware  reliability  parameters. 

We  characterize  the  reliability  of  the  computing  device  on  which 
the  detector  is  implemented  by  the  probability  q  that  it  remains  fault- 
free  during  the  mission  time  of  the  detector;  that  is,  during  the  time 
required  for  the  computing  device  to  produce  the  decision  variable  d. 

If  A  is  the  event  that  the  computing  device  is  fault-free  during  the 
mission  time  of  the  detector,  then  q  =  P(A) .  We  can  now  find  the  proba¬ 
bility  of  coincidence  p  between  the  theoretical  and  implemented  decision 
e 

variables  d  and  d.  If  we  let 

r  =  P(d=d*|A°) 


then 

p  =  P(d=d*)  =  q  +  r(l-q).  (2.6) 

Although  it  is  reasonable  to  assume  that  q  can  be  determined  exper¬ 
imentally,  one  cannot  make  the  same  statement  concerning  r.  Therefore  r 
will  be  considered  a  parameter  to  be  chosen  by  the  designer  based  on  his 
level  of  optimism.  In  the  most  pessimistic  case  every  hardware  fault 


would  cause  d  £  d*  and  thus  one  would  choose  r  *  0.  The  case  r  *  1,  in 
which  hardware  faults  can  never  affect  the  value  of  d,  is  of  no 
interest,  and  thus  we  shall  always  assume  r  <  1. 

Ve  can  now  relate  K  to  p.  In  view  of  the  definition  of  K  given  in 
Theorem  1,  and  the  definition  of  p  given  in  Eq.  (2.6), 

K  -  8^(p) 

where  g^p)  =  p. 

In  light  of  Corollary  2  and  Eq.  (2.6),  the  implemented  detector 
will  have  at  least  one  feasible  operating  point  if  and  only  if 

»1(»>  i 


that  is 

4  *  t(l-4)  i  E.la. 

For  a  fixed  r  there  is  clearly  a  smallest  value  of  q  for  which  the  above 
inequality  is  satisfied.  As  a  result  the  following  corollary  is 
obtained. 

Corollary  2.:  Under  Hypotheses  1  and  2,  for  a  given  confidence  level  r  < 
1,  at  least  one  operating  point  of  the  implemented  detector  is  feasible 
if  and  only  if 


III.  PERFORMANCE  USING  UNCONDITIONAL  MASKING 


The  aini mud  computing  device  reliability  q1  obtained  in  the  preced¬ 
ing  aection  nay  exceed  the  reliability  of  any  available  device.  In  this 
case  aoae  action  mast  be  taken  to  decrease  the  required  minimum  relia¬ 
bility.  As  we  shall  now  show,  one  way  to  accoaplish  this  goal  is  to  nse 
an  unconditional  masking  scheme  based  on  hardware  redundancy.  To  imple¬ 
ment  such  a  scheme  we  send  the  original  data  sample  to  a  identical  com¬ 
puting  devices  which  are  instructed  to  carry  out  identical  operations  on 
the  data,  and  which  produce  decision  variables  d. ,  d, .....  d  .  These 
decision  variables  are  then  sent  to  the  masker  which  produces  a  final 
decision  variable  d^  whose  value  is  equal  to  that  of  the  majority  of  the 
d^'s.  If  dffl  =  1  the  signal  is  declared  present;  if  »  0  the  signal  is 
declared  absent. 

Ve  shall  adopt  the  following  hypothesis  concerning  the  computing 
devices  and  the  masker. 

Hypothesis  2.: 

(i)  The  events  (d^»d*),  i  =  1,  2,...,  a,  are  mutually  independent  and 
have  identical  probabilities  of  occurrence. 

(ii)  The  events  S  and  (d  si)  are  each  independent  of  the  events  (d^-d*), 
i  *  1,  2,...,  a. 

(iii)  The  masker  generates  the  quantity  d  as  follows: 

a 

d  ■  1  if  *  d.  >  a/2 
i-1  1 

a 

d  -  0  if  X  d.  <  a/2 
"  i-1  1 


•->  -•'  v 


•**>  ’  J  f  J  ***  *«*  *<•*  »  *  X  *("•  ^ '*»  -  1.***  "*•  1  •  " 
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d  =  1  or  0  with  probability  O.S  each,  otherwise . 

IB 

Note  that  (ii)  is  just  a  restatement  of  Hypothesis  2  for  each  computing 
device. 

When  an  unconditional  masker  is  used,  the  probabilities  of  false 
alarm  and  detection  are  given  by 

Pp  =  P(dB=llSc) 

PD  -  P<dB=l IS) . 

The  following  theorem  relates  the  performance  of  the  detector  imple¬ 
mented  with  an  unconditional  masker  to  that  of  the  theoretical  detector. 

Theorem  £:  If  Hypothesis  3  is  satisfied, 

Pp  »  IP*  +  (1-K)(l-Pj)  (3.1) 

P„  =  KP *  +  (l-K)(l-pJ)  (3.2) 

where  K  *»  P(d  *=d*) . 

n 

Proof:  Once  one  recognizes  that  parts  (ii)  and  (iii)  of  Hypothesis  3 
imply  that  the  events  S  and  (d*=l)  are  each  independent  of  the  event 
(d^-d*).  one  can  proceed  in  analogy  to  the  proof  of  Theorem  1.  D 

It  is  clear  from  a  comparison  of  Theorems  1  and  2  that  the  use  of 
the  unconditional  masking  scheme  does  not  change  the  form  of  the  rela¬ 
tionship  between  the  pairs  (Pp»PD)  and  (Pp,P*) .  Therefore  if  Hypotheaes 
1  and  3  are  aatiafied,  the  detector  implemented  with  the  masker  will 


have  at  least  one  feasible  operating  point  if  and  only  if  K  1  K  .  .  The 

Bin. 

next  step  is  to  relate  (  to  the  reliability  of  the  conputing  devices. 

As  in  Section  II  we  characterize  the  reliability  of  the  computing 
devices  that  generate  the  quantities  dt ,  d, .....  d  by  the  probability  q 
that  each  remains  fault-free  during  the  mission  time  of  the  detector, 
and  thus  if  we  let 

p  =  P(di»d*),  i  =  1,  2,...,  a 

then 

p  =  q  +  r(l-q)  (3.3) 

where  r  is  the  confidence  level  parameter  also  discussed  in  Section  II. 

Next  let  G( be  the  real-valued  map  defined  for  all  positive 
integers  a,  non-negative  integers  y  £  o,  and  scalars  p  in  the  interval 
[0,1],  by 

It  is  clear  that  G(a,y,p)  is  the  probability  that  at  most  y  of  the  dj's 
do  not  equal  d*.  This  fact  immediately  leads  to  the  following  lemma,  in 
which  K  is  expressed  in  terms  of  a  and  p. 

Lemma  1.:  If  Hypothesis  3  is  satisfied, 

K  *  P(d#=d*)  ■  g2(o,p) 


where 
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g2(a,p)  -  G(a,^-,p),  a  odd  (3.4) 

g2(a,p)  ■  G(o,^^,p)  +  0‘5fo/2j*(o/2)  |^1_P)a^2pa^2»  a  «▼«“•  (3.5) 

In  light  of  Lena  1  and  the  discnaaion  following  Theorem  2.  it  ia 
clear  that  the  detector  implemented  with  an  unconditional  masker  will 
have  at  least  one  feasible  operating  point  if  and  only  if 

*2(«.P>  i  I,la.  (3.6) 

In  order  to  write  Eq.  (3.6)  aa  a  constraint  on  q.  some  well  known  facts 
about  g2(.,.)  need  to  be  stated. 

Lena  £:  (i)  For  a  fixed  positive  integer  a,  g2(a#p)  is  a  continuous, 

strictly  increasing  function  of  p  with  g2(a.O)  »  0  and  g2(a,l)  ■  1. 

(ii)  If  a  is  odd.  g2(a+l.p)  *  g2(a,p);  if  in  addition  p  >  0.5,  then 

g2(a+2 ,p)  >  g2(a,p)  and  limg2(a,p)  «  1. 

a— 

The  next  theorem  follows  from  Lemma  2(i). 

Theorem  Under  Hypotheses  1  and  3,  for  a  given  confidence  level  r  <  1 
and  a  given  redundancy  level  a,  the  detector  implemented  with  an  uncon¬ 
ditional  masker  has  at  least  one  feasible  operating  point  if  and  only  if 

I  P2(a)-r\ 

q  1  maxjo,  '  J  -  q2(o)  (3.7) 

where  p2(a)  satisfies 

g2(o.p2(o))  ■  (3.8) 


It  is  important  to  determine  whether  the  use  of  unconditional  sash¬ 
ing  leads  to  a  weakening  of  the  reliability  requirement  relative  to  that 
obtained  in  Section  II.  The  following  corollary  gives  the  affirmative 


Corollary  ±:  If  a  -  1  or  2,  then  q^a)  -  q±.  If  a  2  3  and  qx  *  0,  then 
q2(a)  “  0.  If  a  2  3  and  q^  >  0,  then  q^(a)  <  q^. 

Proof:  Since  gjd.p)  «  g2<2,p)  *  p,  q^l)  ■  ^(2)  =  q^.  If  a  2  3.  since 

'■in  >  °*5'  *2(a''.in)  >  'min  and  thns  Eq.  (3.8)  implies  p2(a)  < 

If  q2  ■  0  then  i  r  and  therefore  P2(a)  <  r  and  q^a)  *  0.  If  q1  > 

0  then  >  r  and 

tp,(o)-rl  K  .  -r 

i=r-J  <  -  w  -  v° 


In  many  situations  the  type  of  computing  device  is  given,  and  thus 
q  is  fixed.  The  next  theorem,  which  follows  from  Lemma  2(ii),  charac¬ 
terizes  the  minimum  redundancy  level  which  will  ensure  that  at  least  one 
feasible  operating  point  exists. 


Theorem  Under  Hypotheses  1  and  3,  for  a  given  confidence  level  r  <  1, 
a  given  q  such  that  q+r(l-q)  >  0.5,  and  <  1,  the  minimum  redundancy 

level  necessary  to  guarantee  that  the  detector  implemented  with  an 
unconditional  masker  has  at  least  one  feasible  operating  point  is  «2(q), 
where  a2<q)  is  the  smallest  (necessarily  odd)  integer  such  that 

4  ^2<a2(q)) * 


IV.  PERFORMANCE  USING  CONDITIONAL  MASKING 


It  may  be  the  case  that  unconditional  masking  is  not  sufficient. 
That  is,  for  a  given  computing  device,  the  minimum  redundancy  level 
specified  by  Theorem  4  may  be  too  costly;  or  for  a  given  redundancy 
level,  the  minimum  device  reliability  stated  in  Theorem  3  may  exceed 
that  of  any  available  device.  In  this  case  the  nse  of  conditional  mask 
ing  may  be  appropriate.  Vith  conditional  masking  the  final  decision 
variable  d_  is  produced  as  in  Section  III,  but  d^  is  used  to  make  a 
decision  concerning  the  presence  of  the  signal  only  when  the  number  of 
identical  d^'s  i*  sufficiently  high.  Thus  the  operation  of  the  condi¬ 
tional  masker  will  be  characterized  by  a  positive  integer  i  £  a,  and  a 
boolean  variable  b  that  will  be  set  at  0  if  at  least  (  of  the  d^'s  are 
identical,  and  set  at  1  otherwise.  If  b  -  0,  we  make  a  decision  con¬ 
cerning  the  presence  of  the  signal  using  the  decision  variable  d  .  If 

fll 

b  =1,  we  make  no  decision  concerning  the  signal.  Note  that  if  (  < 

m.  the  quantity  b  is  always  equal  to  0  and  conditional  masking 
reduces  to  unconditional  masking.  The  notation  fx*|  indicates  the  smal¬ 
lest  integer  greater  than  or  equal  to  x. 

Ve  shall  therefore  adopt,  in  addition  to  Hypothesis  3,  the  follow¬ 
ing  hypothesis  concerning  the  masker. 

Hypothesis  ±:  Given  a  positive  integer  Z  £  a,  the  masker  generates  the 
quantity  b  as  follows: 
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b  *  1,  otherwise. 

Vhen  s  conditional  masker  is  used,  the  probabilities  of  false  alarm 
and  detection  are  given  by 

Pp  -  PU.-llS*  and  b=0) 

Pn  »  P(d=l Is  and  b=0) . 
u  n 

The  penalty  that  must  be  paid  when  using  a  conditional  masker  is  the 
probability  PR  of  making  no  decision  concerning  the  signal  given  that 
the  final  decision  variable  is  eqnal  to  the  theoretical  decision  vari¬ 
able;  that  is, 

PR  =  P(b»lldB«d*) . 

Therefore  we  must  specify  an  npper  bound  P®  on  the  penalty  PR  in  addi¬ 
tion  to  the  already  existing  bounds  on  the  probabilities  of  false  alarm 
and  detection,  and  the  detector  iaplemented  with  a  conditional  masker 
must  satisfy  the  constraints  Pp  £  P®,  Pp  2  pJ|*  »nd  PR  i  PR. 

The  following  theorem  relates  the  performance  measures  PR  and  Pp  of 
the  detector  implemented  with  a  conditional  masker  to  those  of  the 
theoretical  detector. 


I 


i-v 


k'.'- 


Theorem  If  hypotheses  3  and  4  are  satisfied, 


Pp  -  KPp  +  U-KXI-PJJ) 


(4.1) 


PD  “  + 


(4.2) 
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where  K  “  P(d  «d*|b*4)). 

B 

Proof :  Since  Hypotheses  3  end  4  imply  that  the  events  S  end  (d*=l)  are 
each  independent  of  the  event  (b»0) ,  one  can  proceed  in  analogy  to  the 
proof  of  Theorea  1.  0 

Once  again  the  fora  of  the  relationship  between  the  pairs  (PD,Pn) 

I*  D 

and  (P*,P*)  is  the  saae  as  it  was  in  Theoreas  1  and  2.  Therefore  if 
Hypotheses  1,  3  and  4  are  satisfied,  the  detector  implemented  with  the 
conditional  masker  will  have  at  least  one  feasible  operating  point  (that 
is,  it  will  satisfy  Pp  £  P®  and  PD  2  Pjj)  if  end  only  if  K  2 

The  next  step  is  to  relate  K  and  PR  to  the  reliability  of  the  com¬ 
puting  devices. 

Leaaa  £:  If  Hypotheses  3  and  4  are  satisfied,  then  for  £  2  p^| 

K  »  P(dB*=d*|b»©)  *  g3(a,(,p) 

PR  -  P(b-l|dB=d*)  «  g4(a,5,p) 

where 

-  1  +  G( a . a-sVpT -  °G( a . { -1 , p )  <4-3) 

- 1  -  g(,y;.V)>>  •  u-4) 

Proof:  If  5  2  P^"| ,  the  events  (dB«d*  and  b"0) ,  (at  least  $  of  the  d^'s 
equal  d  )  and  (at  aost  a-(  of  the  d^'s  do  not  equal  d  )  are  equivalent. 
Also,  the  event  (b«0)  is  equal  to  the  union  of  the  two  disjoint  events 


respectively 


Theorem  £:  Under  Hypotheses  1,  3  and  4,  for  a  given  confidence  level  r  < 

1,  a  given  redundancy  level  a,  and  a  condition  level  g  2  ,  the 

detector  implemented  with  a  conditional  masker  has  at  least  one  feasible 

operating  point  if  and  only  if 

f  P,(a.g)-r  1 

q  2  max  jO,  - »  J  =  q3 (<*,$) 

where  pj(a,g)  satisfies 

S3  ( o> ( «P3  ( ) )  =  (4.5) 

Theorem  2:  Under  Hypotheses  1,  3  and  4,  for  a  given  confidence  level  r  < 

1,  a  given  redundancy  level  a,  and  a  condition  level  g  2  the 

detector  implemented  with  a  conditional  masker  satisfies  P  ^  P°  if  and 

K  K 

only  if 

J  P4<a»5>”*1 

q  2  . j_r  J  -  q4(u,g) 

where  p4(u.g)  satisfies 

*4(«*.5.P4(a.g))  -  P°.  (4.6) 

It  is  clear  that  if  g  <  then  conditional  masking  reduces  to 

unconditional  usking.  In  this  case  we  will  define  q^(u,g)  *  q^(a)  and 

44(a,g)  -  0. 

In  view  of  Theorems  6  and  7#  the  minimum  device  reliability  q 
needed  to  meet  all  the  constraints  must  satisfy 


-  22  - 


q  1  max  (q3 (o,?) ,q4(a,$) } . 

The  condition  level  £  can  be  chosen  by  the  designer  to  optimize  perfor¬ 
mance.  Given  a,  let  5#(a)  be  a  condition  level  that  satisfies 

®**{q3  («*»?*(<*) )  ,q^(a,5*(o) )  }  £  max{q3  (a,{) ,  q^(a,()} 

for  every  $  in  the  interval  [l,a],  Ve  are  then  led  immediately  to  the 
following  theorem. 

Theorem  £:  Under  Hypotheses  1,  3  and  4,  for  a  given  confidence  level  r  < 
1  and  a  given  redundancy  level  a,  the  detector  implemented  with  a  condi¬ 
tional  masher  has  at  least  one  feasible  operating  point  and  satisfies  P 

1C 

£  P®  if  and  only  if 

q  1  max  tq3<a.5*(a))  .q^a.^U)) }  -  qjU).  (4.7) 

One  must  determine  on  a  case  by  case  basis  whether  the  use  of  con¬ 
ditional  stashing  leads  to  a  weahening  of  the  reliability  requirement 
relative  to  that  obtained  for  unconditional  mashing  in  Section  III. 
Although  it  is  clear  that  q^Ca)  £  q^( a) »  a  strict  iaiprovement  is 
achieved  only  when  the  penalty  bound  P®  is  sufficiently  large. 

If  we  consider  q^Ca)  as  a  function  of  a,  we  can  directly  determine 
the  minimum  redundancy  level  necessary  to  meet  all  the  constraints  for  a 
given  device  reliability  q. 

Theorem  £:  Under  Hypotheses  1.  3  and  4,  for  a  given  confidence  level  r  < 
1,  a  given  device  reliability  q  such  that  q+r(l-q)  >  0.5,  and  K  ,  <1, 


iMi. 


the  minimum  redundancy  level  necessary  to  guarantee  that  the  detector 
implemented  with  a  conditional  masker  has  at  least  one  feasible  operat¬ 
ing  point  and  satisfies  PR  i  PR  is  «*5(q),  where  o5<q)  is  the  smallest 
integer  such  that 

q  ^  QjtOjU))  •  (4.8) 

It  is  clear  that  a^(q)  i  a?(q),  but  strict  inequality  will  hold 
only  if  PR  is  sufficiently  large.  Once  again  this  issue  must  be  decided 


on  a  case  by  case  basis. 


V.  CONCLUSION  AND  EXAMPLE 


In  this  paper  we  have  analyzed  the  effects  of  hardware  faults  on 

signal  detector  implementations.  Ve  have  shown  that,  under  reasonable 

assumptions,  the  design  of  the  theoretical  detector  and  the  design  of 

the  implementation  are  coupled  through  a  single  quantity  K  .  As  a 

mill 

result,  we  have  been  able  to  determine  the  minimum  device  reliability 
needed  to  ensure  that  the  performance  constraints  are  satisfied,  whether 
we  use  no  masking,  unconditional  masking  or  conditional  masking. 

The  results  of  this  paper  can  be  used  to  synthesize  a  step-by-step 

design  procedure  for  fault  tolerant  signal  detectors. 

Step  1:  Given  the  theoretical  ROC,  P°  and  P°  compute  K  ,  . 

r  D  min 

Step  2:  Using  the  paper's  results,  choose  the  type  and  number  of  comput¬ 
ing  devices,  and  the  type  of  masking  scheme. 

Step  3:  Compute  the  value  of  K  that  corresponds  to  the  choices  in  Step 

2. 

Step  4:  At  this  stage,  we  have  one  or  more  feasible  operating  points  on 
the  implemented  ROC.  Choose  one  of  these  points,  say  (Pp,PD>,  according 
to  some  optimality  criterion.  For  example,  for  the  Neyman-Pe arson 
operating  point  choose  Pp  =  Pp  and  Pp  =  fK(Pp) . 

Step  5:  Using  X,  Pp  and  Pp,  compute  the  corresponding  theoretical 
operating  point  (Pp,P*) •  If  Is  this  operating  point  that  is  used  in  the 
instructions  of  the  computing  devices. 

Ve  now  present  a  simple  example  to  demonstrate  the  improvement  on 
minimum  device  reliability  provided  by  the  masking  schemes.  Consider 
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the  ROC  that  occurs  in  the  context  of  discriminating  between  two  zero- 

2  2 

mean  Ganssian  processes  with  variances  and  a*  [7,  p.  411: 


PF  ’’o'  «] 


If  we  choose  a  confidence  level  r  =  0.5,  a  /c  =  1/3,  P?  »  0.1,  P? 

OX  F  D 

-0.7  and  P®  =  0,  then  K  =  0.949  and  q4  =  0.898.  This  is  the  minimum 
k  mxi  x 

required  device  reliability  when  only  a  single  device  is  used.  If  we 
now  use  unconditional  masking,  then  for  a  *  1  or  2,  q^a)  =  *  0.898; 

if  a  =  3  or  4,  q^Ca)  =  0-728;  if  a  =  5  or  6,  q^ta)  “  ^.620.  Note  that 
we  cannot  use  conditional  masking  since  P®  **  0. 

Suppose  now  that  P®  -  0.25.  Obviously,  we  can  use  unconditional 
masking  to  obtain  the  same  results  given  above,  but  we  can  try  to 
improve  on  those  results  by  using  conditional  masking.  In  fact,  if  a  ■ 
2,  then  £#(a)  =  2  and  q^Ca)  =  0.624;  if  a  **  3,  then  conditional  masking 
offers  no  improvement  over  unconditional  masking;  if  a  *  4,  then  $t(a)  = 
3  and  q^(a)  «  0.536;  if  a  **  5,  then  5,(«)  ■  4  and  q^(a)  *  0.558;  if  a  = 
6,  then  5#(a)  =  4  and  q^Ca)  *  0.478  . 
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